topic Re: How to edit my search to filter only IPs that have multiple Attack Names associated with them? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-filter-only-IPs-that-have-multiple/m-p/291636#M88086 <P>Yes it worked. Thank you</P> Thu, 23 Mar 2017 12:07:39 GMT alexburst37 2017-03-23T12:07:39Z How to edit my search to filter only IPs that have multiple Attack Names associated with them? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-filter-only-IPs-that-have-multiple/m-p/291634#M88084 <P>How do I filter only IPs that have multiple Attack Names associated with them? Here is the search string so far; however, we are unable to filter out the values of 1: </P> <PRE><CODE>sourcetype="mcafee:ids" | stats dc(Attack_Name) by SIP </CODE></PRE> <P>How do I return results by SIP where Attack_Names are greater than 1?</P> Wed, 22 Mar 2017 19:28:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-filter-only-IPs-that-have-multiple/m-p/291634#M88084 alexburst37 2017-03-22T19:28:07Z Re: How to edit my search to filter only IPs that have multiple Attack Names associated with them? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-filter-only-IPs-that-have-multiple/m-p/291635#M88085 <P>Is this?</P> <P>sourcetype="mcafee:ids" | stats dc(Attack_Name) as count by SIP| search count&gt;1</P> Thu, 23 Mar 2017 02:20:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-filter-only-IPs-that-have-multiple/m-p/291635#M88085 HiroshiSatoh 2017-03-23T02:20:02Z Re: How to edit my search to filter only IPs that have multiple Attack Names associated with them? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-filter-only-IPs-that-have-multiple/m-p/291636#M88086 <P>Yes it worked. Thank you</P> Thu, 23 Mar 2017 12:07:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-filter-only-IPs-that-have-multiple/m-p/291636#M88086 alexburst37 2017-03-23T12:07:39Z